Maximizing Cyber Security Protects Client Confidentiality

Law firm security is critical. Success in the legal field is based on an unparalleled level of trust between lawyers and their clients. Clients count on lawyers because of the promise of client confidentiality. When that confidence is breached, the law firm’s most valuable asset is destroyed.

Delta Risk evaluates, advises, and assists law firms with minimizing cyber risks to maintain that client trust. Our team has the technical and operational experience to effectively assist law firms with their cyber security needs, including technical experts who have developed a unique law firm cyber security assessment methodology utilizing the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

---

Ensure You Have Met and Exceeded Client Duty of Care

Legal Industry Security Program Assessment

A complete cyber security strategy starts with testing the strength of your information security program. Reviewing program effectiveness enables your law firm to take steps to meet and exceed your duty of care.

Our assessments review your current program’s strengths and weaknesses to find any security gaps. We can also advise your firm on optimal solutions based on your risks and resource constraints.

Once developed, you will want to test the effectiveness of your program in simulated real-world scenarios. Delta Risk offers a host of cyber security exercises. These exercises are tailored to your firm’s specific requirements and developed with our expertise in handling law firm cyber security matters.

With insider threats being among the biggest threats to client confidentiality for law firms, we also provide services directed at managing the human element of security, including:

• Vulnerability Assessments
• Cyber Security Exercises
• Incident Response Services
• Vendor Assessments

We Focus on Your Security So You Can Focus on Your Firm

Delta Risk’s managed security services allow your organization to supplement its existing security infrastructure in a way that won’t break the bank. Our services are custom-tailored to meet your specific needs.

Law Firm Managed Security Services

Delta Risk’s cloud and managed security services efficiently and effectively manage your security so you can focus on your core duties and save on developing an in-house cyber security team. Our services are custom-tailored to meet your specific needs — all while being scalable to the size and complexity of your firm.

Law Firm Incident Response Services

In the event that your firm suffered a breach, or you suspect one has occurred, we maintain a variety of services to help you respond swiftly.

Delta Risk can:

• Run a compromise assessment to eliminate network threats;
• Coach your firm to manage an active incident, and;
• Provide a response team equipped with the resources to contain attacks quickly.

Cyber Concerns in the Legal Sector

Without proper cyber security measures, law firms are taking risks on multiple fronts. Not only are you putting client information directly at risk, you are indirectly risking the disclosure of valuable client intellectual property rights, confidential information on business strategies, and ultimately your own firm’s reputation.

To some, it may come as a surprise that law firms are suffering cyber-attacks. This is understandable given very few law firms disclose such incidents unless it is absolutely necessary because of the damage to their reputation that could result.

One example of such a disclosure and injury is the recent revelation of the “Panama Papers.” Mossack Fonseca was known as a giant of the offshore world with a reputation for extreme secrecy. Now that reputation is shattered.

Some of the worst breaches of confidential information are the result of an employee at the firm. This can be due to disgruntled employees or those that are merely negligent in handling sensitive information. In either case, the disclosure of information is still a breach of client confidentiality.

Upholding Legal Liability and Client Confidentiality

Depending on your law firm’s business associates, you may have obligations to comply with certain cyber security regulations of a specific industry. The most notable of these would be those affecting healthcare information and the regulations concerning the financial sector.

Other than specific industry regulations, law firms must be concerned with professional negligence and malpractice claims, breach of contract suits, and even class-action lawsuits.

Beyond legal liability, there may be further consequences of a breach. For one, all 50 U.S. states, the District of Columbia, Guam, Puerto Rico, and the Virgin Islands have breach notification laws. These laws require breached entities to notify affected individuals if an incident meets certain conditions.

As an attorney, another concern you must personally consider are the consequences of failing to follow your rules of professional conduct. The American Bar Association (ABA) has updated several of the Model Rules of Professional Conduct to better address challenges of modernization in the legal field. As relevant here, rules 1.1, 1.6, and 5.3 concern cyber security matters. Here is a brief description of the changes:

• 1.1 Competence – to be competent, a lawyer must understand the benefits and risks of relevant technology;
• 1.6 Confidentiality – many states issued advisory opinions addressing the reasonableness of cyber security measures;
• 5.3 Non-lawyer Assistance – lawyers must ensure third parties working with the firm (including cloud services), as well as their own employees, are following reasonable security measures.

Many states have adopted the new language in full or in part. As more of the legal field becomes digitized, the rules will continue to change to reflect the need for increased cyber security.